vulkro-sf org report
Generate a single shareable, reviewer-ready live-org security posture report (HTML or Markdown) for a connected org.
This is the one-command deliverable for the live-org audit the desktop
console shows on its Org security posture tab. It captures the same
consolidated org snapshot the console audit captures through your own
authenticated sf CLI, derives the identical finding set, and renders
one report you can hand to a reviewer or check into a ticket.
The CLI report and the console tab surface the same findings because they share one engine.
Synopsis
vulkro-sf org report --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | html | markdown | html | Output format. |
--output, -O <path> | path | stdout | Write the report to this file instead of stdout. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
Note that the output flag here is capital -O. The lowercase -o is
the alias for --target-org on the org command family.
What the report captures
The report consolidates the live-org snapshot into one document:
- Identity and over-privilege - permission sets, profiles, and the effective permissions users hold.
- Session, password, clickjack, and CSRF settings - the org's security-settings posture.
- Connected-app OAuth posture - scope and callback configuration on live Connected Apps.
- Installed packages - what is installed and which entries are unverified.
- Org-complexity signals - the shape-of-the-org metrics that frame the findings.
Scope and honesty
The analysis runs on your machine. No source code, no findings, and no org data leave the machine.
Findings are static shape and likelihood signals, not runtime-validated exploits, and the report never certifies an org clean.
Exit codes
0- no posture findings, or the org was unreachable (in which case the report says so).1- posture findings reported.2- error: unknown--format, or the report file could not be written.
Examples
# HTML report for a reviewer, written to a file.
vulkro-sf org report --target-org my-prod -O org-posture.html
# Markdown for pasting into a ticket.
vulkro-sf org report --target-org my-prod --format markdown -O org-posture.md
# Pipe Markdown straight to stdout.
vulkro-sf org report --target-org my-prod --format markdown
Where to go next
- vulkro-sf org status - confirm you are pointed at the org you think you are, before generating a report.
- vulkro-sf org perms - the permission-set and profile audit on its own.
- vulkro-sf org packages - installed package risk on its own.
- Live org setup - connecting an org for the first time.
- vulkro-sf serve - the desktop console that renders the same audit interactively.